Add proxy support for add account by token#90
Merged
dwgx merged 1 commit intodwgx:masterfrom Apr 29, 2026
Merged
Conversation
dwgx
added a commit
that referenced
this pull request
Apr 29, 2026
Merging — thanks @smeinecke. The fail-closed default (`ALLOW_PRIVATE_PROXY_HOSTS=` empty) preserves SSRF protection for public deployments while unblocking local/private-network testing for opt-in users. Follow-ups for v2.0.27 (will track in repo, no action needed from you): - Add a `test/ssrf.test.js` covering: default-OFF rejects 192.168/10.x/localhost, opt-in `ALLOW_PRIVATE_PROXY_HOSTS=1` allows them, IPv6 link-local still rejected. - Doc note: this switch should NOT be enabled on public-facing dashboards. - Will rebase #90 on top of this once you fix the account-create-before-proxy-validation ordering (see comments there).
dwgx
requested changes
Apr 29, 2026
Owner
dwgx
left a comment
There was a problem hiding this comment.
非常感谢 @smeinecke — 这个功能用户呼声不小(#84 #87 都隐含相关诉求),方向完全对。但合并前有一处 数据完整性 bug 需要先修。
阻塞点:账号先建后校验代理 → 失败留下僵尸账号
当前 src/dashboard/api.js 大约 +295 行的逻辑:
// 这里 addAccountByKey/addAccountByToken 已经把账号写进 store 了
} else {
return json(res, 400, { error: 'Provide api_key or token' });
}
// 然后才校验 proxy
if (body.proxy) {
const parsed = parseProxyUrl(body.proxy);
if (!parsed) {
return json(res, 400, { error: 'ERR_PROXY_FORMAT_INVALID' }); // ← 账号已存在,但接口返回 400
}
if (config.allowPrivateProxyHosts) {
await validateHostFormat(parsed.host); // ← 同上,throw 后账号还在
} else {
await assertPublicUrlHost(parsed.host); // ← 同上
}
setAccountProxy(account.id, parsed);
ensureLsForAccount(account.id).catch(...);
}用户视角:贴 token + 写错 proxy → dashboard 报 400 → 用户以为没添加成功 → 重试 → 重复账号 / 已经吃掉 quota / 配额异常。
建议的修法(顺序倒过来)
// 1. 先解析 + 校验 proxy(如果传了),失败直接 400,不碰 account store
let parsedProxy = null;
if (body.proxy) {
parsedProxy = parseProxyUrl(body.proxy);
if (!parsedProxy) return json(res, 400, { error: 'ERR_PROXY_FORMAT_INVALID' });
if (config.allowPrivateProxyHosts) {
await validateHostFormat(parsedProxy.host);
} else {
await assertPublicUrlHost(parsedProxy.host);
}
}
// 2. 然后再创建账号
let account;
if (body.api_key) account = await addAccountByKey(...);
else if (body.token) account = await addAccountByToken(...);
else return json(res, 400, { error: 'Provide api_key or token' });
// 3. 最后绑定 proxy
if (parsedProxy) {
setAccountProxy(account.id, parsedProxy);
ensureLsForAccount(account.id).catch(e => log.warn(`LS ensure failed: ${e.message}`));
}顺手建议
- 加个测试
test/account-add-proxy.test.js:bad proxy → 0 accounts;good proxy → 1 account + proxy bound;no proxy → 1 account no proxy。 - 这个 PR 把 #88 的
ALLOW_PRIVATE_PROXY_HOSTS改动复带进来了。我刚 merge 了 #88,请 rebase 一下,把重复的.env.example/setup.sh/config.js/net-safety.js/ 文档改动删掉,只留 add-account 相关的 diff 即可。 App.addAccount()失败分支目前还 toast 原始r.error,可以改用统一的App.translateError(r.error)helper(#89 引入的error.${code}模式)— 不过这个不是 blocker,可以另开 PR。
修好这一处 + rebase 完,我立刻 merge。再次感谢 🙏
Contributor
Author
|
You're right. I'll fix this and rebase the branch. Thank you for the feedback! |
Owner
|
Oh, I'm very sorry I didn't realize just now that you are not Chinese. I used Chinese. Thank you for your Pull |
Add optional proxy input to dashboard single-account add form. Mirrors batch-import proxy binding — user can specify http://proxy:8080 or socks5://user:pass@host:port per account. Backend validates format via parseProxyUrl(), respects ALLOW_PRIVATE_PROXY_HOSTS config (validateHostFormat vs assertPublicUrlHost), calls setAccountProxy() + ensureLsForAccount(). UI clears proxy field on success. i18n for EN/zh-CN.
072d151 to
a4dc792
Compare
dwgx
added a commit
that referenced
this pull request
Apr 29, 2026
#91 — 从本地 Windsurf 桌面客户端读凭证: - 新增 src/dashboard/local-windsurf.js:扫 state.vscdb (sqlite) 抽 windsurfAuthStatus + sessions - 新增 GET /accounts/import-local:req.socket.remoteAddress 严格 loopback 校验 - 默认 UI 加「从本地 Windsurf 导入」按钮 + 列表展示 + 一键导入 - 用 node:sqlite 零依赖,Node 20 graceful 降级到 ~/.codeium/config.json fallback #90 follow-up — proxy 校验顺序修正: - /accounts POST 把 proxy 解析+校验提到 addAccount 之前,避免失败留僵尸账号 - 新增 4 条 test/account-add-proxy-ordering.test.js 锁住 测试:327/327 passing(+16 新);i18n guard ✓
4 tasks
smeinecke
added a commit
to smeinecke/WindsurfAPI
that referenced
this pull request
Apr 29, 2026
…ounts Move api_key/token presence check to top of POST /accounts handler - runs before proxy validation + account creation. Prevents proxy network checks when credentials are missing. Simplify account creation to ternary expression (api_key vs token path). No functional change to validation order from dwgx#90 (proxy still validated before account creation).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
改了什么 / What changed
Added an optional proxy field to the "Add Account" form in the Account Pool dashboard. Users can now specify a proxy (in
protocol://[user:pass@]host:portformat) when adding an account via API Key or Auth Token, instead of having to configure it separately after the account is created.为什么 / Why
Previously, when adding an account to the pool, users had to:
This was inconvenient, especially when managing multiple accounts with different proxies. The batch import feature already supported specifying proxies inline, but the single account addition form did not. This change brings feature parity between batch import and single account addition.
测试 / Testing
Tested proxy validation:
not-a-proxy) returnsERR_PROXY_FORMAT_INVALIDhttp://192.168.1.1:8080) is blocked by default (returnsERR_PROXY_PRIVATE_IP)ALLOW_PRIVATE_PROXY_HOSTS=1is sethttp://proxy.example.com:8080) works correctlysocks5://user:pass@host:port) parses correctlyTested dashboard UI:
Verified proxy is applied immediately:
Checklist